Topic 3.1 Quiz: Network Fundamentals | AP Cybersecurity

Unit 3 • 3.1 • Quiz

Home›AP Cybersecurity›Unit 3 › 3.1 › Quiz

Lesson 3.1 Quiz: Network Fundamentals

5 questions — Demonstrate your understanding of network architecture and security

Score: 0 / 0 Answer each question, then check your score below

Scenario Organization

Meridian Energy Grid

Meridian Energy Grid operates a network spanning corporate offices, SCADA operations centers, 200 substations, and customer-facing billing portals. The network carries both IT traffic (email, web) and OT traffic (SCADA commands, sensor telemetry).

Q1 OSI Model

Meridian’s SCADA controllers communicate with substations using Modbus/TCP. A network engineer captures a packet showing: Ethernet frame (MAC addresses), IP header (source/destination IP), TCP header (port 502), and Modbus application data. How many OSI layers are represented in this packet?

(A) Two — Layer 1 (physical cable) and Layer 7 (Modbus data) (B) Three — Layers 2, 3, and 7 only (C) Four — Layer 2 (Ethernet/MAC), Layer 3 (IP), Layer 4 (TCP), and Layer 7 (Modbus application data) (D) Seven — every OSI layer is always present in every packet

The captured packet shows four distinct layers: Ethernet frame = Layer 2 (Data Link), IP header = Layer 3 (Network), TCP header = Layer 4 (Transport), Modbus data = Layer 7 (Application). Layer 1 is the physical medium (not visible in a capture). Layers 5-6 are not explicitly present.

(A) Four layers are visible, not two.

(B) TCP (Layer 4) is also explicitly present.

(D) Not all 7 layers are explicitly present in every packet.

Exam Tip: Packet captures show Layer 2+ (you cannot capture Layer 1 — it is the physical signal). Count distinct headers: Ethernet=L2, IP=L3, TCP/UDP=L4, application data=L7.

Q2 Attack Surface

Meridian discovers that 30 substations still run a legacy web management interface on port 8080 with default credentials (admin/admin). These interfaces were installed 15 years ago and forgotten. This is an example of:

(A) Attack surface reduction — legacy systems have fewer features and therefore fewer vulnerabilities (B) Shadow IT — unauthorized systems deployed without security team knowledge that expand the attack surface (C) Defense-in-depth — the legacy interfaces add an additional management layer (D) Least privilege — the default credentials provide minimal access

Forgotten legacy systems with default credentials are a textbook attack surface expansion. They were deployed without security oversight, remain unpatched and unmonitored, and provide easy entry with admin/admin credentials. Shadow IT = systems outside the security team’s visibility.

(A) Legacy systems often have MORE vulnerabilities due to unpatched software.

(C) Unmanaged interfaces are liabilities, not defensive layers.

(D) admin/admin is maximum access, not least privilege.

Exam Tip: Shadow IT and forgotten systems are among the most dangerous attack surface components because they are unpatched, unmonitored, and often have default credentials.

Q3 TCP Handshake

A Meridian engineer connects to a substation controller via SSH. The TCP three-way handshake completes (SYN → SYN-ACK → ACK) before the SSH session begins. What does the handshake establish?

(A) The encryption key for the SSH session (B) A reliable, bidirectional TCP connection between the engineer’s workstation and the controller, confirming both sides are ready to exchange data (C) The engineer’s identity and authorization level on the controller (D) The physical route that packets will take through the network

The TCP three-way handshake establishes a reliable connection: SYN (client requests), SYN-ACK (server acknowledges and requests), ACK (client confirms). After the handshake, both sides know the connection is established and data can flow reliably. Encryption (SSH) and authentication happen AFTER the TCP connection is established.

(A) Encryption is negotiated by SSH after TCP connection is established.

(C) Authentication occurs at the application layer (SSH), not during TCP handshake.

(D) Packet routing is determined by IP routing tables, not TCP handshakes.

Exam Tip: TCP handshake = connection establishment (L4). Everything else (encryption, authentication, data exchange) happens AFTER the connection is established, at higher layers.

Q4 Network Hardening

Which of the following is the LEAST effective network hardening measure for Meridian’s SCADA network?

(A) Disabling all unnecessary services and closing unused ports on SCADA controllers (B) Changing default credentials on all network management interfaces (C) Renaming the SCADA VLAN from “SCADA-PRODUCTION” to “VLAN-47” to hide its purpose from attackers (D) Implementing network segmentation to isolate SCADA from corporate IT

Renaming a VLAN is security through obscurity — it provides no actual protection. Attackers scan traffic patterns and IP ranges, not VLAN names. The other three options (closing ports, changing defaults, segmentation) provide measurable security improvements.

(A) Effective — closing ports directly reduces attack surface.

(B) Effective — default credentials are the first thing attackers try.

(D) Effective — segmentation limits lateral movement between IT and OT.

Exam Tip: Security through obscurity (hiding names, renaming ports, obfuscating labels) is never a substitute for real controls. Attackers use scanners, not name lookups.

Q5 DNS Security

Meridian implements DNSSEC on its authoritative DNS servers. What does DNSSEC provide that standard DNS does not?

(A) DNSSEC encrypts all DNS queries so eavesdroppers cannot see which domains are being resolved (B) DNSSEC cryptographically signs DNS responses, allowing clients to verify that the response has not been tampered with and came from the legitimate server (C) DNSSEC blocks all malicious domains automatically by maintaining a global blocklist (D) DNSSEC replaces DNS with a faster protocol that does not require port 53

DNSSEC adds cryptographic signatures to DNS responses. Clients can verify: (1) the response came from the authoritative server, and (2) the response was not modified in transit. It prevents DNS spoofing/cache poisoning but does NOT encrypt queries (that is DoH/DoT).

(A) DNSSEC provides authentication and integrity, not encryption. DNS over HTTPS (DoH) provides encryption.

(C) DNSSEC verifies response authenticity; it does not maintain blocklists.

(D) DNSSEC extends DNS; it does not replace it or change the port.

Exam Tip: DNSSEC = authentication + integrity for DNS responses (prevents spoofing). DoH/DoT = encryption for DNS queries (prevents eavesdropping). They solve different problems and can be used together.

Questions Correct

Course Hub → Course Hub

← Lab 3.1 Course Hub →

AP Cybersecurity Unit 3 • 3.1 • Quiz | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

AP Cybersecurity · Unit 3 · Lesson 3.1 · Quiz

Lesson•Exercise 1•Exercise 2•Lab•Quiz•Next: 3.2 Network Threats & Attacks →

Back to:Lesson 3.1 Unit 3 Study Guide Course Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]